Find risky code, AI-agent vulnerabilities, and supply-chain issues earlier they ship.
Website · Docs · Security & Data Flow · Benchmark · Pricing · Blog · Contribute
Ship Safe is an AI information scanner for modern package teams. It runs locally successful your repo, finds issues crossed exertion code, AI agents, MCP configs, prompts, dependencies, CI/CD, secrets, and cloud-adjacent configuration, past helps you reappraisal and use safe fixes.
Start a scan pinch 1 command:
No signup. No API cardinal required for scanning. Works offline for halfway checks. AI-backed red-team modes usage your configured supplier erstwhile available.
Use --no-ai to guarantee a afloat section scan. Provider-backed classification, heavy analysis, and GPT-Red nonstop bounded discourse straight to your selected supplier aft best-effort credential masking. See Security & Data Flow for nonstop boundaries and discourse limits.
| AI and LLM security | Prompt injection, supplier hijacking, excessive agency, representation poisoning, RAG poisoning, unsafe instrumentality calls |
| MCP and supplier configs | Over-broad instrumentality permissions, poisoned registries, untrusted transports, vulnerable allowlists |
| Application security | SQL/NoSQL injection, XSS, SSRF, auth bypass, way traversal, insecure API routes |
| Secrets and compliance | API keys, tokens, credentials, PII, leaked secrets successful git history |
| Supply chain | Typosquatting, dependency confusion, risky instal scripts, unpinned AI actions |
| CI/CD | Pipeline poisoning, unpinned GitHub Actions, concealed logging, unsafe workflow triggers |
- Scan locally - Ship Safe inspects your repo pinch targeted agents and skips checks that do not apply.
- Review findings - Findings see severity, record location, evidence, and recommended remediation.
- Fix pinch control - The supplier proposes a scheme and diff, asks earlier writing, verifies the result, and keeps changes reversible.
- Gate successful CI - Use ship-safe ci to neglect risky builds and upload SARIF into GitHub codification scanning.
- Built for AI-native apps: catches risks successful agents, MCP servers, prompts, RAG flows, managed-agent configs, and AI-powered CI.
- Fast section feedback: tally it earlier a PR, during review, aliases wrong CI without sending codification to a hosted scanner.
- Fixes are reviewable: each suggested alteration is shown arsenic a diff earlier it touches your files.
- Works pinch your stack: JavaScript, TypeScript, Python, config files, infrastructure files, GitHub Actions, and more.
- Open root core: MIT-licensed CLI pinch docs, examples, and a increasing supplier system.
Free CLI, Paid Team Workflows
The open-source CLI is the fastest measurement to scan immoderate repo locally. Upgrade erstwhile you request a hosted workflow astir the aforesaid scanner:
| Local scans, audits, and agent-assisted fixes | Free CLI |
| Scan history, unreality dashboard, and PDF reports | Pro |
| Shared workspace, PR Guardian, squad reports, and collaboration | Team |
Compare plans astatine shipsafe.sh/pricing.
Ship Safe Cloud, the hosted dashboard for scan history, PR Guardian, billing, and squad workflows, is developed successful a backstage repository because it contains commercialized merchandise codification and hosted infrastructure workflows. The nationalist ship-safe repo remains focused connected the MIT-licensed CLI, information agents, rules, fixtures, CI integrations, and documentation. See Ship Safe Cloud for the repo boundary.
All agents tally successful parallel. Each skips irrelevant projects automatically.
| InjectionTester | Code Vulns | SQL/NoSQL injection, bid injection, XSS, way traversal, XXE, ReDoS, prototype pollution |
| AuthBypassAgent | Auth | JWT flaws (alg:none, anemic secrets), CSRF, OAuth misconfig, BOLA/IDOR, TLS bypass |
| SSRFProber | SSRF | User input successful fetch/axios, unreality metadata endpoints, soul IPs |
| SupplyChainAudit | Supply Chain | Typosquatting, wildcard versions, suspicious instal scripts, dependency confusion |
| ConfigAuditor | Config | Docker (root user, :latest), Terraform, Kubernetes, CORS, CSP, Firebase, Nginx |
| SupabaseRLSAgent | Auth | service_role cardinal successful customer code, tables without RLS, anon cardinal inserts |
| LLMRedTeam | AI/LLM | OWASP LLM Top 10: punctual injection, excessive agency, strategy punctual leakage |
| MCPSecurityAgent | AI/LLM | MCP server misuse, instrumentality poisoning, typosquatting, unvalidated inputs |
| AgenticSecurityAgent | AI/LLM | OWASP Agentic AI Top 10: supplier hijacking, privilege escalation, Kimi K3/OpenAI-compatible tool-call misuse |
| RAGSecurityAgent | AI/LLM | Context injection, archive poisoning, vector DB entree control |
| MemoryPoisoningAgent | AI/LLM | Instruction injection successful supplier representation files, hidden Unicode payloads (ASI-01, ASI-05) |
| PIIComplianceAgent | Compliance | SSNs, in installments cards, emails, telephone numbers successful root code |
| VibeCodingAgent | Code Vulns | AI-generated codification anti-patterns: nary validation, quiet catches, TODO-auth |
| ExceptionHandlerAgent | Code Vulns | Empty catches, unhandled rejections, leaked stack traces (OWASP A10:2025) |
| AgentConfigScanner | AI/LLM | Prompt injection successful .cursorrules, CLAUDE.md, malicious Claude Code hooks |
| MobileScanner | Mobile | OWASP Mobile Top 10 2024: insecure storage, WebView injection, debug mode |
| GitHistoryScanner | Secrets | Leaked secrets successful git perpetrate history |
| CICDScanner | CI/CD | Pipeline poisoning, unpinned actions, concealed logging (OWASP CI/CD Top 10) |
| APIFuzzer | API | Routes without auth, wide assignment, GraphQL introspection, debug endpoints |
| ManagedAgentScanner | AI/LLM | Claude Managed Agent misconfigs: always_allow policies, unrestricted networking (ASI-03–ASI-07) |
| HermesSecurityAgent | AI/LLM | Tool registry poisoning, function-call injection, accomplishment support drift (ASI-01–ASI-10) |
| AgentAttestationAgent | Supply Chain | Unpinned supplier versions, missing integrity hashes, unsigned manifests (ASI-10, SLSA L0) |
| AgenticSupplyChainAgent | Supply Chain | Over-privileged AI CI actions, OAuth scope creep, unsigned AI webhook receivers (ASI-02, ASI-06) |
| RobloxSecurityAgent | Supply Chain | Malicious Roblox/Luau Toolbox assets (runtime plus injection, rbxassetid:// loaders, HttpEnabled, payloads hidden successful lawsuit attributes) |
| ModelScanAgent | Supply Chain | Code-execution payloads successful ML exemplary weights (pickle opcodes successful .pt/.pkl/.ckpt), torch.load without weights_only, scanner-evasion archives (CWE-502, CWE-506) |
| TrustBoundaryAgent | Agentic | GhostApproval symlink attacks (config-named links into ~/.ssh/~/.aws/.env), repo symlinks escaping the tree, and Friendly Fire run-on-review instructions successful agent-read docs (CWE-59, CWE-61) |
| SlopSquatAgent | Supply Chain | Hallucinated / phantom package imports (slopsquatting) — bare imports not declared, installed, aliases builtin, positive known AI-hallucinated names (CWE-1357) |
| ClickFixAgent | Supply Chain | ClickFix / fake-CAPTCHA paste-and-run lures (fake correction + Win+R/Ctrl+V/command-bar keystrokes, PowerShell cradles) and fake-installer npm lifecycle scripts (CWE-1357, CWE-506) |
| InstallGuardAgent | Supply Chain | npm worm behaviors successful lifecycle scripts (credential harvesting, env exfiltration, destructive rm -rf, obfuscated node -e) and weaponized binding.gyp node-gyp actions (CWE-506, CWE-829) |
Post-processors: ScoringEngine · VerifierAgent (secrets liveness) · DeepAnalyzer (LLM taint analysis)
| /scan | Re-scan the project |
| /agent | Run the interactive hole loop |
| /findings | List findings from the past scan |
| /show <n> | Full item connected uncovering n |
| /plan <n> | Preview hole scheme for uncovering n (no writes) |
| /undo [--all] | Revert the past hole (or each fixes) |
| /share | Publish scan study arsenic a nationalist URL (7 days) |
| /diff | Show git working-tree diff |
| /provider <name> | Switch LLM supplier mid-session |
| /quit | Exit (also Ctrl-D aliases Ctrl-C) |
Anything not starting pinch / is sent to the LLM arsenic a free-form question, pinch your latest scan results arsenic context.
Works pinch immoderate supplier — auto-detected from situation variables. Use --provider <name> to override.
Anthropic · OpenAI · Google · DeepSeek · Kimi K3 / Moonshot · Groq · Together · Mistral · xAI · Perplexity · Ollama · LM Studio · immoderate OpenAI-compatible endpoint
Kimi defaults to kimi-k3 done MOONSHOT_API_KEY aliases KIMI_API_KEY. Use --provider kimi --model kimi-k3 for long-context GPT-Red and deep-analysis runs.
For Kimi K3-specific long-context reddish teaming:
Ship Safe besides checks Kimi K3 / OpenAI-compatible tool-call implementations for move instrumentality loading from punctual context, missing instrumentality allowlists, forced instrumentality calls connected untrusted input, and replayed instrumentality results without the original adjunct tool-call message.
No API cardinal required for halfway scanning. AI classification and red-team --gpt-red usage your configured supplier erstwhile available, pinch deterministic offline fallback for GPT-Red checks.
critical findings are ever reported. An inline remark cannot hide one, and an effort to suppress 1 is recorded successful the scan. The remark is meant for a human ruling retired a mendacious positive, and thing that tin constitute a statement of your source — including an AI supplier — tin constitute the remark too, truthful the highest severities do not grant it. Every suppression is counted, truthful a scan that silenced findings ne'er sounds for illustration 1 that had none.
Recall is the easy half of a scanner. A instrumentality that flags everything catches everything and is useless, truthful we measurement the different half: what Ship Safe says about codification that is almost surely fine.
Down from 1031 findings crossed the aforesaid 4 projects earlier v9.6.3, verified against NodeGoat and DVWA truthful the driblet is reduced sound alternatively than lost detection. The 1 remaining captious is simply a mendacious affirmative and the benchmark says which and why.
Corpus pinned by commit, reproducible pinch 1 command, limits documented: benchmarks/false-positives/
How does it comparison to Semgrep, Gitleaks, Trivy, CodeQL?
Run Ship Safe alongside them, not alternatively of them. CodeQL does interprocedural taint study Ship Safe does not attempt, Gitleaks is the master for secrets, and Trivy has a existent CVE database down it.
Ship Safe covers a narrower question: what an AI coding supplier conscionable did to your repository, your CI, and your section instrumentality configuration. MCP customer config, agent representation poisoning, hallucinated-package imports and AIBOM are the areas where we recovered nary balanced nationalist rules successful the different four.
Full sum matrix, verified against their nationalist registries, including where they hit us: docs/comparison.md
10.0 is Hermes Agent coverage. Ship Safe already scans Hermes deployments, but against v0.13.0 while Hermes is connected v0.20.0 — the ACP adapter, TUI gateway, serverless terminal backends, cron blueprints and plugin manifests each shipped in betwixt pinch nary coverage.
See the roadmap for what is planned and what is deliberately not, and the 10.0 milestone for claimable work. Everything successful it is unfastened to contributors.
Ship Safe is unfastened source, and the champion contributions are small, focused improvements that make AI-assisted improvement safer.
Good first areas:
- Add a focused information supplier for an AI, MCP, CI, cloud, aliases supply-chain risk
- Add a precise information norm to an existing agent
- Add susceptible fixtures and regression tests
- Write examples for section scans, CI gates, red-team workflows, and MCP/agent setup
Start here:
- Good first issues
- Contributor guide
- Add an agent
- Add a information rule
- Handle MCP situation variables safely
- Release process
Ship Safe is MIT-licensed and free forever.
Ship fast. Ship safe. — shipsafe.sh
English (US) · 
Indonesian (ID) ·